What does ESTABLISHED state indicate in netstat?

• A. The socket has an established connection.
• B. The socket is actively attempting to establish a connection.
• C. The socket is waiting for a shutdown from the remote end.
• D. The socket is listening for incoming connections.

Answer: (A)

ESTABLISHED means there is an active TCP connection. The three-way handshake has completed, and both ends can exchange data. In netstat, this state signals that the socket is connected and transmitting or receiving data.

This differs from a connection in progress (SYN_SENT), which means the handshake hasn’t finished yet; from a shutdown phase (FIN_WAIT or CLOSE_WAIT), which indicates the connection is being closed; and from listening (LISTEN), which means the socket is waiting for new incoming connections rather than an active one.